Original subtitles

1

Email, now, is one of the most important

2

online services that we use.

3

For most people

4

it can be a single point of security failure,

5

because many of our accounts are linked to it.

6

If you have a email compromise,

7

your associated accounts are also compromised.

8

Private information will be compromised,

9

including your name, address, contacts,

10

friends and anything else

11

that’s associated or stored within your email.

12

It’s obvious to most people

13

why email security is important,

14

but email unfortunately is fundamentally broken,

15

as far as security is concerned,

16

and it cannot be fixed.

17

All we can do is keep putting sticky plasters on it.

18

Plasters which, unless everyone else adopts,

19

which is pretty much the same as

20

changing email completely,

21

we’re just not going to fix

22

these security problems that are inherent in email.

23

Email is from a time when security wasn't thought of.

24

But we continue to use email

25

because it is ubiquitous,

26

everybody has an email address now.

27

If everyone suddenly switched

28

to a secure messaging alternative tomorrow,

29

the problem would be solved.

30

But because that’s not going to happen,

31

we are stuck with a broken

32

messaging system called email.

33

This means you will need to convince others

34

to adopt encryption technology

35

if you want to communicate with them privately.

36

You can't do it on your own.

37

Let's take it from the beginning.

38

So there are two ways to access email.

39

First, you’ve got your web browser

40

using functionality like HTML5 and JavaScript.

41

And probably most people now think of that as email,

42

that is the most common way

43

that people tend to access email,

44

you know, via Gmail or Yahoo Mail.

45

But the second way that is used is an email client,

46

which is something like Thunderbird, or Claws, or Outlook,

47

people might use commonly at work.

48

You have Mac Mail,

49

or you have the mail apps

50

that you get on your cell and mobile phones.

51

Those are all email clients.

52

And most email providers will allow you

53

to use both methods, the webmail access

54

and the email client.

55

With webmail, you access via HTTPS, port 443,

56

which is running SSL and TLS encryption,

57

or at least you should be,

58

that is the standard solution for most people.

59

If you’re not, then it’s extremely insecure,

60

but really, almost all webmail will be encrypted

61

using HTTPS, port 443, SSL/TLS.

62

You authenticate that server,

63

that the server is genuine

64

via a certificate as is normal with HTTPS,

65

and the client is authenticated usually with a password.

66

And if you can,

67

you should change your authentication method

68

to be Two Factor Authentication,

69

as this mitigates password attacks

70

as we’ve discussed in the Password section.

71

You should find an email provider

72

that offers Two Factor Authentication.

73

If you only use webmail,

74

then emails are only stored on the server.

75

And then we have the email client.

76

With an email client, there are a number of protocols

77

and port options for both sending and receiving email.

78

So the options when it comes to receiving mail,

79

is you have IMAP port 143, which is unencrypted,

80

you have POP port 110, which is unencrypted;

81

you don't want to use these.

82

If you care anything about your email security,

83

receiving emails, then you don't want to use these,

84

and most providers now either don't provide them,

85

or provide encrypted alternatives.

86

And those alternatives are IMAP port 993,

87

which is running SSL/TLS encryption

88

with the certificate based server-side authentication,

89

like with a website,

90

and you have POP 3 on port 995,

91

running the same SSL/TLS encryption

92

with, again, certificate based server-side authentication.

93

And those are the two that

94

you want to go after for receiving email.

95

IMAP port 993 and POP 3 port 995.

96

Now, some email providers

97

may put those on different ports,

98

but those are the de facto port numbers.

99

But what is important, is that

100

they are both running SSL and TLS.

101

Now, when it comes to the difference

102

between IMAP and POP,

103

of the two, IMAP is the popular option

104

when you need to check your emails

105

from multiple devices, such as a laptop,

106

phone, tablet and so on,

107

because the emails are synced using IMAP

108

with the server and all devices.

109

All devices retain copies

110

with the server having the master copy.

111

This is the most convenient

112

and what most people will be used to using.

113

POP3, alternatively, downloads emails

114

from the server to a single email client,

115

then deletes the emails from the server.

116

Because your messages get downloaded

117

to a single email client,

118

and then deleted from the server,

119

it can appear that the mail is missing,

120

or disappeared from your inbox

121

if you try to check your mail

122

from a different email client or webmail.

123

But you may want this for security though,

124

to have no emails stored on the server.

125

If you’re worried about people accessing the server,

126

use POP3.

127

If you’re worried about people accessing your laptop,

128

store on the server and the client with IMAP.

129

Then we have the protocols

130

for sending emails with an email client.

131

We have SMTP port 25,

132

which is the original unencrypted port to use;

133

you don't want to use this if you care about

134

your emails and sending your emails and privacy.

135

Then you have something called STARTTLS,

136

which is usually on port 587.

137

And that is for using SSL/TLS encryption.

138

And then you have SMTP port 465,

139

which again is SSL/TLS encrypted.

140

You want to use, when it’s possible,

141

SMPT port 465 with the SSL/TLS.

142

STARTTLS on 587 is more susceptible

143

to man-in-the middle attacks.

144

So go with the SMTP port 465, SSL/TLS option.

145

For both email clients and webmail,

146

the SSL/TLS will use a cipher suite, obviously.

147

You want this to be a good one.

148

Ideally, using Elliptical Curve Diffie-Hellman,

149

so the session keys are ephemeral,

150

so that if the private key is compromised,

151

only small amounts of data is compromised.

152

The section on Encryption covers this.

153

If you remember, back to when we looked at Cipher Suites,

154

we used a tool called SSL Labs, which is here.

155

This doesn't scan SMTP or IMAP SSL

156

mail ports unfortunately, but you can use it

157

for checking port 443 for webmail.

158

So for example here, I could check “ghostmail”,

159

and see how their SSL/TLS stacks up.

160

And here we go, A+.

161

Now see, elliptical curve, RSA_WITH_AES,

162

so yeah, they seem to be doing all the right things there.

163

And, if you want to examine the other ports like 465, 587,

164

you’ve got a few options for how you can do that.

165

One with Kali, is you have SSLscan,

166

and if you press Return here,

167

that's just going to simply do port 443.

168

But if you want to do a special port,

169

you would do 465,

170

so then you could look at the SMTP over TLS/SSL.

171

Just press return here.

172

And look at there;

173

because ghostmail only has a webmail interface,

174

but if they did have port 465 open,

175

you could check that out.

176

So here we see what we saw

177

with SSL Labs, the same Cipher Suites.

178

Another way of checking out the mail servers

179

which I like is these guys here.

180

So if we put in an email address

181

of someone that you know, and we click Try,

182

or if you put in even a dummy email address,

183

if you put test@ghostmail, or gmail,

184

or what have you, click Try,

185

it communicates with the mail servers.

186

It finds out

187

who the mail server is for that domain,

188

because it isn't always ghostmail.com, or that domain.

189

So we can see here,

190

we have the mail server there, that is taken

191

from what’s called the MX record for that domain,

192

MX is the mail record, or mail exchange record.

193

And what we can see here

194

is the communication with the mail server,

195

you can see there, this is using STARTTLS,

196

and there we can see the Cipher Suite that it uses.

197

And what you’re actually seeing here is text,

198

ASCII communication with that port.

199

So these commands are actually being put

200

into the package stream for that port.

201

But I can show you an example of that.

202

So let's check out maybe Gmail.

203

So first of all, we need to figure out

204

what the mail server address is,

205

so we need to use something called “NSLOOKUP”.

206

Says is doing a DNS lookup

207

to check the mail exchange record,

208

which will give us

209

the IP address of the mail server for gmail.com.

210

And there we go,

211

and we can see actually they’ve got

212

quite a few which is no surprise.

213

So to issue text-based SMTP commands,

214

we need to use some sort of tool that allows us to do that,

215

we can use Telnet, we can use Netcat.

216

Netcat is a tool that enables you to read and write

217

to network connections using TCP and UDP.

218

So if I go –

219

So as you can see,

220

I can just issue standard text commands.

221

But that is what this is doing,

222

so I must try that command.

223

25. Paste. There we go.

224

So we see we get the same response.

225

It’s given us some options,

226

therefore what we want to do.

227

So STARTTLS, etc.

228

So, let’s escape out of there.

229

But yeah, essentially

230

if we issue the same commands here,

231

we are going to get the same sort of response.

232

Now, moving on to Authentication.

233

For Authentication, as I’ve said,

234

certificates are used to verify the server,

235

“is who they claim to be?”

236

The email client will use his own certificate repository

237

or that of the operating system,

238

just the same as a browser does

239

to validate that the server is who the server is.

240

So that’s the same as HTTPS,

241

browsing, server authentication, you know, it’s the same thing.

242

And we can, of course,

243

look at the certificates that are on there,

244

and this is a useful site to do that.

245

So if we click on “More Detail” here,

246

let's have a look down.

247

And there we go,

248

we can see the first certificate in the chain.

249

There’s the public key.

250

And the certificate itself,

251

and then the second certificate in the chain,

252

we can see all the way down as to

253

where the root certificate is.

254

Client-side authentication.

255

So depending on the mail client,

256

you will have different options for authentication,

257

so those include things like

258

transmitting the password unencrypted,

259

which was what was originally done.

260

And then you’ve got transmitting the password encrypted,

261

because you’re using SSL or TLS.

262

You can do things like Kerberos or GSSAPI,

263

which is something generally used

264

for enterprise solutions.

265

You’ve got NTLM,

266

which is a Microsoft solution

267

if you’re connecting to exchange servers.

268

You could use TLS/SSL

269

or some type of certificate

270

for your client authentication.

271

There’s something called OAuth2

272

that you can use; but generally,

273

you want to try and use

274

some form of strong authentication

275

or two-factor authentication if you can,

276

and we covered two-factor authentication in its own section.